The Investigatory Powers Tribunal and the rule of law – Natasha Simonsen
16 February 2015
Liberty & Ors v GCHQ [2015] UKIPTrib 13_77-H (6 February 2015) – read judgment
Despite being hailed as an ‘historic victory in the age-old battle for the right to privacy and free expression’, closer examination of a recent ruling by the Investigatory Powers Tribunal (‘IPT’) reveals it to have been a hollow victory.
The case arose from the Snowden leaks, which unveiled a vast communications interception program led by the US National Security Agency (‘NSA’). Intercepted communications can include the content of emails as well as ‘metadata’, and can extend to purely internal communications as well as communications with a US connection. For example, an email exchange between Leeds and London may be liable to interception by the NSA simply because it happens to be routed through a US server at some stage along the line. The Regulation of Investigatory Powers Act 2000 (‘RIPA’) establishes a framework for interception of communications by UK authorities, but of course those provisions don’t apply to interceptions by foreign state authorities in their own territory. Once intercepted by the NSA, mutual intelligence sharing arrangements can lead the same Leeds-London email to be handed over to the UK authorities, notwithstanding that the UK authorities would have needed a RIPA warrant had they wished to conduct the interception themselves.
A range of NGOs led by Liberty claimed violations of Articles 8 and 10 of the European Convention on Human Rights by the intelligence services in the reception, use, storage and transmission of such material. Importantly, the Articles 8 and 10 rights to privacy and free expression are not unqualified: they may be limited ‘in accordance with the law’ or as ‘prescribed by law’, and [as] necessary in a democratic society’ pursuant to (inter alia) ‘the interests of national security’. The claimants alleged that the absence of a legal framework for regulating intercepted material of this kind violated the ‘in accordance with law’ requirement in Article 8 and the ‘prescribed by law’ requirement in Article 10.
The ‘prescribed by/in accordance with law’ requirement has been the subject of detailed guidance from the Strasbourg Court in cases such as Malone v UK, Khan v UK, Liberty v UK and Kennedy v UK. The upshot of those cases is that to be considered ‘in accordance with law’ the measures must satisfy three requirements. They are (1) ‘the impugned measure must have some basis in domestic law’; (2) the relevant domestic law must be ‘compatible with the rule of law and accessible to the person concerned’; and (3) ‘the person affected must be able to foresee the consequences of the domestic law for him’: see Kennedy, at [151].
The IPT’s judgment last week in Liberty & Ors v GCHQ substantially watered down those requirements. In place of the first Kennedy requirement, the IPT held it was sufficient that ‘appropriate rules or arrangements exist and are publicly known and confirmed to exist’ [41]. This reference to ‘arrangements’ (emphasis in the original judgment) is significantly vaguer than the requirement in Kennedy for a clear basis in domestic law, and in light of the Tribunal’s finding, it seems it will be satisfied by the mere existence of internal guidelines or policies. In place of the second Kennedy requirement, the IPT held that the content of the rules need only be ‘sufficiently signposted, such as to give an adequate indication’ of their content: [41] (original emphasis). The deletion of the reference to the rule of law in the Kennedy criterion is significant: as is well known, the rule of law is generally taken to require (at least, and inter alia) that laws be clear, prospective, open and stable. How else can laws purport to guide conduct? Finally, in place of the third Kennedy requirement of foreseeability, the IPT held that the ‘arrangements’ need only be ‘subject to proper oversight’: [41]. The existence of an Interception of Communications Commissioner, and of the IPT itself, was of considerable importance in that regard. The rule of law requirements of clarity and openness have been dispensed with, in favour of mere ‘arrangements’ that are ‘publicly known and confirmed to exist’, however ambiguous are the ‘signposts’ as to their content, and however toothless the mechanisms for oversight.
As this comparison with Kennedy shows, the IPT adopted a substantially lower threshold than the Strasbourg Court for what constitutes a measure that is ‘prescribed by law’. And yet, stunningly, even on this low standard, the IPT found a breach. This was the first time since its establishment that the Tribunal has found against the government. However, the breach was historic rather than continuing. This was because in the course of the hearings in December 2014, the intelligence agencies agreed to disclose two paragraphs, presumably from an internal policy document. The two disclosed paragraphs gave ‘an adequate indication’ of the nature and content of the ‘arrangements in place’. Prior to this disclosure, the IPT held that there was insufficient information in the public domain to satisfy the ‘in accordance with/prescribed by law’ requirement in Articles 8 and 10 ECHR.
What, then, did those two decisive paragraphs say? Not as much as one might think, given that the simple fact of this disclosure was, in the Tribunal’s estimation, sufficient to convert an unlawful interception regime into a lawful one. Quoted in full at [47] in the judgment, in essence they provide that requests for ‘unanalysed intercepted communications (and associated communications data)’ are only made by the UK intelligence services in two circumstances. They are:
- when a RIPA warrant has been issued but assistance from the foreign government is necessary ‘because [the communications] cannot be obtained under the relevant RIPA interception warrant’; and
- when there has been no RIPA warrant, but making a request for the communications to be intercepted by the foreign state would ‘not amount to a deliberate circumvention of RIPA’. In both cases it must be ‘necessary and proportionate for the Intelligence Services to obtain those communications’.
Thus, in the IPT’s view, the ‘prescribed by law’ requirement in Articles 8 and 10 of the European Convention can be satisfied by GCHQ’s disclosure of two paragraphs from an internal policy document; little more than a promise that the agencies will not, and do not, ‘deliberately circumvent RIPA’. This is an extraordinary result, particularly given the recent revelations in the Belhaj case still pending before the IPT to the effect that MI5 and MI6 deliberately intercepted privileged communications between lawyers and clients, in at least one case passing on intercepted communications to the legal team defending the intelligence agencies against Mr Belhaj’s claim. Despite this evidence of past infractions, the IPT was prepared to accept the evidence of the chief of the Office for Security and Counter-Terrorism in Liberty v GCHQ that the duties undertaken by the intelligence services were ‘underpinned…. by a culture of compliance’ [42].
There is no domestic appeal from judgments of the IPT, but the decision will no doubt be appealed to Strasbourg. At a time when the Strasbourg Court is under considerable pressure from a restive UK, it will be interesting to see whether it holds the line it drew in Kennedy, or whether, like the IPT, it will compromise its commitment to the rule of law.
Natasha Simonsen is Lecturer in Law, New College and St Peter’s College, Oxford
Sign up to free human rights updates by email, Facebook, Twitter or RSS
Related posts:
- Cracking intercepts: the war on terror and difficulties with Human Rights
- Sexual liaisons by undercover police officers could be authorised by RIPA
- Barristers tell Parliament that some GCHQ mass surveillance is illegal
This blog is run by 
